CYBER ESSENTIALS PLUS · SOUTH WALES
Tested before the assessor arrives
From £1,795 for the audit, on top of basic certification at £795 which you have to hold first. Both assessment fees are inside those figures. We test your machines against the assessor's own criteria before booking them, because a failed audit costs you the fee again and the deadline you were working to.
- Pre-tested against the assessor criteria
- Both assessment fees included
- We sit the audit with you
Trusted by businesses across South Wales
Certified, not just recommending it
We hold Cyber Essentials ourselves
It would be a strange thing to sell and not hold. We take clients through the same certification, start to finish.
Pricing
What it costs
Ring three providers and ask what they charge. You will get three discovery calls and no numbers. Ours are published, excluding VAT, with out-of-scope work quoted before it starts rather than after.
See all pricesExcluding VAT. Plus sits on top of basic certification rather than replacing it, so a business starting from nothing is buying both. Both assessment fees are inside the figures. Remediation is quoted after the pre-test, which is the point of doing the pre-test.
The day to day
What is included
Everything below is in the price, including the assessment fees for both tiers. Remediation is quoted after the pre-test, which is the entire reason for doing the pre-test.
An internal pre-test
We run the same checks the assessor runs, on the same kind of sample, before anybody is booked. Whatever it finds gets fixed while there is still time to fix it.
Scoping that holds up
Which machines are in scope and which are not, agreed in writing and defensible. Scope arguments on the day are the commonest cause of a Plus assessment going sideways.
Both assessment fees
The basic fee and the Plus fee, inside our figure rather than added afterwards.
Basic certification alongside it
If you do not already hold it, we do both as one piece of work rather than two engagements with a gap in the middle.
We sit the audit with you
On the day, with the assessor, answering what they ask. You should not have to interpret a security question on your own in front of someone marking you.
A fix and resubmit if it fails
If it fails after we have pre-tested it, we missed something. We fix it and go again at no extra charge.
The difference
What Plus actually adds
Basic certification is a self-assessment. You answer the questions, somebody in your business signs to say the answers are true, and a certification body reviews the answers. It is honest and it is useful, and it rests entirely on what you said.
Plus is the same five controls, checked. An assessor takes a sample of your actual computers and tests them: whether the patches really are applied, whether the malware protection really does catch a test file, whether a standard user really cannot install what they like. They also test your email and web browsing against known-bad files, and they look at your cloud accounts.
So Plus is not a higher standard. It is the same standard with someone verifying it, which is precisely why larger customers and public sector buyers ask for it. If you want the scheme itself explained, that is on the [Cyber Essentials page](/business/cyber-essentials/) and there is no point us writing it twice.
How it runs
Pre-test first, assessor second
The order matters more here than on the basic tier, because a failure is not just a delay. You pay the assessment fee again and you explain the slip to whoever asked you for the certificate.
We agree the scope
Which machines, which users, which locations, which cloud services. Written down and agreed before anything is tested, because a scope that moves on the day is how this goes wrong.
We test it ourselves
The same sample approach and the same criteria the assessor uses. This is where problems surface, while they are still cheap and there is still time.
We fix what it found
Quoted fixed off the back of the pre-test, so you decide with a number in front of you rather than agreeing to open-ended work under deadline.
The assessor tests it
We book it, we sit it with you, and we answer what comes up. By this point there should be nothing they find that we have not already seen.
Being straight about it
Whether you actually need Plus
This is a meaningfully bigger piece of work than basic certification, and plenty of businesses are sold it when they did not need it. Four honest tests.
Somebody has asked for it by name
This is the real reason to buy Plus. An NHS or public sector contract, a large customer's supplier terms, or a tender that specifies the audited tier. If the requirement says Cyber Essentials without the Plus, basic is what you need and it is a fraction of the cost.
You have to hold basic as well
Not instead of. A business starting from nothing is buying both, so the honest figure to budget is £1,795 plus £795 at the smaller band, not the audit price on its own.
Your machines have to actually pass
An assessor testing real computers will find an unpatched laptop that a questionnaire would not. If your estate is behind, Plus surfaces it, which is a good thing done early and an expensive thing done late.
It still does not make you secure
It verifies five controls on a sample on one day. It is a strong signal and a fair requirement, and it is not a substitute for [something watching afterwards](/business/cyber/).
The honest version
What we will tell you on the phone
If you ring us about Plus, the first question we will ask is who asked you for it and what exactly they wrote. More than once that has turned into a shorter conversation and a cheaper piece of work, because the requirement was basic certification and somebody had assumed the audited tier.
The second question is what your computers are running. If a meaningful number are past the date their manufacturer stopped issuing security updates, Plus will fail on them, and we would rather tell you that before you have a date in the diary than after.
And if the answer is that you are in good shape and a real contract needs it, this is a straightforward piece of work with a predictable price, and the pre-test is there so the day itself is uneventful.
Questions
Cyber Essentials Plus, answered
How much does Cyber Essentials Plus cost?
From £1,795 for one to nine staff, or £2,295 for ten to forty-nine, excluding VAT. On top of that you need basic certification, which is £795 at the smaller band, because Plus cannot be issued without it. Both assessment fees are inside those figures. Anything the pre-test finds is quoted separately and fixed before the assessor is booked.
Do we need basic Cyber Essentials first?
Yes, and it has to be current. Plus is a verification of the basic certification rather than a replacement for it, so if you do not already hold it we do both together as one piece of work. That is usually quicker than doing them separately and it avoids the certificate ageing while the audit is arranged.
What does the assessor actually test?
A sample of your real computers rather than all of them. Whether patches are genuinely applied, whether malware protection catches a harmless test file, whether an ordinary user can install software they should not be able to, how your email and browsing handle known-bad files, and your cloud accounts. It is hands on, which is the whole difference from basic.
What happens if we fail?
You normally get a short window to fix what was found and be retested, though a reassessment fee can apply depending on the body and how much has to change. That window is exactly what the pre-test exists to avoid needing. If it fails after we have pre-tested it, we fix and resubmit at no extra charge from us.
How long does it take?
Six to ten weeks from first look to certificate if you are starting from nothing, because it is two pieces of work and the audit has to be booked. If you already hold current basic certification and your estate is in good order, three to four weeks is realistic.
Can you do this if you are not our IT provider?
Yes. We will need enough access to test properly, and if the pre-test finds things your current provider ought to have handled we will say so plainly rather than quietly adding them to a bill.
Is Plus worth it if nobody has asked for it?
Usually not, and we will say so. Basic certification closes the same five controls and costs a fraction of this. Plus earns its money when a customer or a tender specifically requires the audited tier, or when you want the verification for your own confidence and have budgeted for it deliberately.
Services that go with this
We cover South Wales from Pembroke and Narberth in the west to Newport in the east, and from Barry up to Brecon. On-site visits are included on the Professional and Advanced support plans, and quoted before we travel on Essential. See the towns we cover
A free review, and an honest answer
An hour of our time, on site. You get a written list of what is fine, what is risky and what is costing you money. If everything is healthy, we will tell you that and leave you to it.